Every CVE Search/ Get API key

CVE-2022-40716

HashiCorp Consul vulnerable to authorization bypass

6.5 MediumFix available

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.09%Up 0.2 points since Sep 24, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-252
Updated
2026-11-02
CVE List 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-252
Updated
2026-11-02
EUVDEUVD-2022-6870 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
EUVD-2022-6870
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m69r-9g56-7mv8 6.5

HashiCorp Consul vulnerable to authorization bypass

HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. A specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This issue has been fixed in versions 1.11.9, 1.12.5, and 1.13.2. There are no known workarounds.

Record
GHSA-m69r-9g56-7mv8
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-252
Updated
2026-11-02
OSVALPINE-CVE-2022-40716 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
ALPINE-CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2022-40716 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
DEBIAN-CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-m69r-9g56-7mv8 6.5

HashiCorp Consul vulnerable to authorization bypass

HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. A specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This issue has been fixed in versions 1.11.9, 1.12.5, and 1.13.2. There are no known workarounds.

Record
GHSA-m69r-9g56-7mv8
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-252
Updated
2026-11-02
OSVUBUNTU-CVE-2022-40716 6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
UBUNTU-CVE-2022-40716
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBIT-consul-2022-40716 No score

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Record
BIT-consul-2022-40716
Updated
2026-11-02
OSVGO-2022-1029 No score

HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul

HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul

Record
GO-2022-1029
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/hashicorp/consul
Go
 before 1.11.9
1.11.9
github.com/hashicorp/consul
Go
 1.12.0 up to 1.12.5
1.12.5
github.com/hashicorp/consul
Go
 1.13.0 up to 1.13.2
1.13.2
consul
Alpine:v3.16
 1.12.0 up to 1.12.5-r0
1.12.5-r0
consul
Alpine:v3.17
 1.12.0 up to 1.13.2-r0
1.13.2-r0
consul
Alpine:v3.18
 1.12.0 up to 1.13.2-r0
1.13.2-r0
consul
Bitnami
 before 1.11.9, 1.12.0 up to 1.12.5, 1.13.0 up to 1.13.2
1.11.91.12.51.13.2
consul
Debian:11
 All versions, plus listed versions
1.10.12+dfsg1-11.8.7+dfsg1-21.8.7+dfsg1-31.8.7+dfsg1-41.8.7+dfsg1-51.8.7+dfsg1-61.9.17+dfsg2-1
 None known
github.com/hashicorp/consul
Go
 before 1.11.9, 1.12.0 up to 1.12.5, 1.13.0 up to 1.13.2
1.11.91.12.51.13.2
consul
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.6.4~dfsg-3
 None known
consul
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.0.7~dfsg1-5ubuntu11.4.4~dfsg1-2ubuntu21.5.2+dfsg1-61.5.2+dfsg1-101.5.2+dfsg1-121.5.2+dfsg2-14
 None known
consul
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.4+dfsg1-11.8.7+dfsg1-3
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40716 is a medium vulnerability (CVSS 6.5) in Hashicorp Consul, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in github.com/hashicorp/consul 1.11.9.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open